Product Security Lead

About the RoleAt SMART Technologies, security is a critical component of how we design, build, and support our products. The Product Security Lead serves as SMART's subject matter expert for product cybersecurity and Secure Software Development Lifecycle (SSDLC) practices. Working across desktop and embedded software, cloud, and connected products, this role partners with Engineering, Product Management, Legal, Information Systems, Quality, and external stakeholders to help ensure SMART products meet evolving customer, security, and regulatory expectations.
Role SummaryThe Product Security Lead provides technical leadership and subject matter expertise in secure software development, product security, vulnerability management, security architecture, and cybersecurity governance across SMART's product portfolio.
This is a hands‑on role that combines product security expertise, technical leadership, and practical experience across cloud, web, desktop, embedded Android, and connected‑device products. The role works with product teams, engineering leaders, suppliers, and external partners to translate security requirements into practical engineering processes, technical controls, and development practices.
As a trusted advisor to technical and business stakeholders, the Product Security Lead helps shape product security strategy, guide risk‑based decision‑making, support regulatory readiness, and represent SMART on product cybersecurity matters with customers, partners, and certification bodies.
Secure Software Development Lifecycle
Drive continuous improvement of SMART's Secure Software Development Lifecycle (SSDLC).
Embed security requirements into product design, architecture, implementation, testing, and release processes.
Facilitate threat modeling, secure architecture reviews, and risk assessments.
Champion security‑by‑design principles across product teams.
Product Security Engineering & Architecture
Provide guidance on product architecture, secure design, and security controls.
Champion security tooling including SAST, DAST, software composition analysis, dependency scanning, and related practices.
Establish and maintain security requirements, standards, and governance practices.
Support Software Bill of Materials (SBOM) governance and software supply‑chain security initiatives.
Review designs, implementations, incidents, and security findings across cloud, web, desktop, embedded, and connected‑device products.
Vulnerability Management
Establish and maintain product vulnerability management processes.
Review and prioritize vulnerability disclosures, CVEs, penetration test findings, supplier advisories, and security assessments.
Coordinate remediation activities across engineering teams.
Develop risk‑based prioritization frameworks and remediation guidance.
Support product security incident readiness and response activities.
Product Security Strategy and Governance
Shape and maintain SMART's product security strategy.
Assess emerging cybersecurity threats and identify impacts to SMART products and services.
Partner with Engineering and Product Management to prioritize security investments and risk‑reduction initiatives.
Define and report product security metrics, risks, and recommendations.
Regulatory Readiness
Monitor relevant cybersecurity regulations, standards, and frameworks.
Translate applicable security and regulatory requirements into engineering practices and controls.
Conduct gap assessments and recommend remediation plans.
Support audit, certification, and compliance‑readiness activities.
Partner with Legal, Quality, Product Management, and Engineering on regulatory initiatives.
External Coordination
Coordinate with external security assessors, penetration testing firms, test laboratories, and certification bodies.
Support product security assessments, audits, certification activities, and remediation follow‑up.
Collaborate with suppliers and technology partners to review security evidence and communicate SMART's security expectations.
Identify and communicate risks related to third‑party software, services, and supply‑chain dependencies.
Customer and Business Support
Act as a subject matter expert for product cybersecurity.
Support customer security reviews, security questionnaires, whitepapers, bid responses, and procurement activities.
Provide cybersecurity guidance to Product, Engineering, Sales, Customer Success, Legal, and Executive Leadership.
Represent SMART in discussions with customers, partners, auditors, assessors, and external stakeholders.
QualificationsRequired
8+ years of experience in software engineering, application security, product security, or a related cybersecurity discipline.
Experience implementing or operating Secure Software Development Lifecycle (SSDLC) programs.
Experience with threat modeling, vulnerability management, secure architecture reviews, and secure development practices.
Strong understanding of cloud‑connected software products, APIs, authentication systems, and software supply chains.
Proven ability to influence senior leaders and executives, as well as engineering teams, without direct authority, building trust and shaping decisions on security priorities, investments, and risk acceptance.
Excellent written and verbal communication skills, with experience presenting clear, concise recommendations to executive and non‑technical audiences.
Ability to translate technical security risks into business terms, such as revenue, market access, customer trust, and regulatory exposure, to support executive decision‑making.
Preferred
Experience with product cybersecurity regulations and frameworks including CRA, RED, NIST CSF, NIST Secure Software Development Framework (SSDF), IEC 62443, ISO 27001, SOC 2, or similar standards.
Experience supporting customer security reviews, audits, or compliance assessments.
Experience with regulated, embedded (Android), SaaS, cloud, AI‑enabled, or connected‑device products.
Security certifications such as CISSP, CSSLP, GSEC, GIAC, or equivalent.
Experience with modern security tooling, including SAST, DAST, software composition analysis, dependency scanning, and related technologies.
Experience advising executive leadership or board‑level stakeholders on cybersecurity, product risk, or regulatory matters.
#J-18808-Ljbffr